XML Tutorial: Structure, Syntax & Survival Skills

Anatomy of a document

An XML document is a tree of elements. Each element has an opening tag, content (text and/or child elements), and a matching closing tag. Exactly one root element wraps everything; an optional declaration states version and encoding. Attributes attach name="value" metadata to opening tags.

<?xml version="1.0" encoding="UTF-8"?>
<order id="ORD-2026-0612" priority="high">
  <customer vip="true">
    <name>Ada Lovelace</name>
  </customer>
  <items>
    <item sku="KB-75" qty="1"/>
    <item sku="MS-12" qty="2"/>
  </items>
</order>

Elements vs attributes

Both store data; convention decides which. Attributes suit small, single-valued metadata (ids, flags); elements suit content, anything repeatable, and anything that might grow structure later. When converting XML to JSON, attributes typically surface with an @ prefix — which is exactly how our XML to JSON converter keeps them from colliding with child elements.

The five characters you must escape

Inside text and attribute values, five characters have predefined entities: &amp; for &, &lt; for <, &gt; for >, &quot; for double quote, &apos; for apostrophe. The unescaped ampersand is the single most common cause of invalid XML in the wild — every URL with &param= breaks a feed until escaped. For literal blocks (code samples, scripts), CDATA sections <![CDATA[ ... ]]> switch escaping off entirely.

Well-formed vs valid — and the errors that matter

Well-formed means the syntax rules hold: matched tags, strict nesting (<b><i></b></i> is illegal), quoted attributes, one root, legal characters. Valid additionally means conforming to a schema (XSD/DTD) — a vocabulary contract. Most real-world breakage is well-formedness: a tag closed in the wrong order, an unescaped &, content before the declaration. A validator that reports the exact line and column — like our XML Validator — turns each into a ten-second fix.

Namespaces (xmlns) are the last survival skill: they qualify element names so vocabularies can mix (SOAP envelopes wrapping your payload). You rarely write them; you constantly read them. The prefix is just a local alias for the URI — soap:Body and env:Body can be the same element.